Loading malware…
Carbanak, initially tracked as Anunak, is a Windows-based backdoor and remote-access trojan associated with large-scale financially motivated intrusions against banks, payment processors, e-payment systems, and other financial institutions. The malware family emerged around 2013 and became widely known through campaigns in which operators compromised internal bank workstations rather than directly targeting customers, then spent extended periods observing employee activity and institutional workflows before monetizing access.
Carbanak is built in part on leaked Carberp code and provides a mature command-and-control capability set, including remote control of infected systems, keylogging, screenshot capture, screen-video recording, and support for interactive remote access through VNC-related functionality and abuse of legitimate remote administration tools. It has also been observed enabling concurrent Remote Desktop sessions, querying Windows proxy settings from the Registry, installing itself as a Windows service for persistence and SYSTEM-level execution, and using anti-analysis checks to detect sandboxed environments.
For communications, Carbanak uses HTTP-based command and control with encrypted payloads and Base64-encoded message bodies. It can exfiltrate data in compressed chunks, including splitting larger messages into smaller units. Operationally, Carbanak-enabled intrusions have supported lateral movement to payment systems, card-processing environments, and ATM-management infrastructure. Associated theft activity has included fraudulent transfers, manipulation of account balances within banking databases, and ATM cash-out operations.
Carbanak has been used by multiple financially motivated threat clusters, most notably the group commonly tracked as FIN7, though use of the malware is not exclusive to a single actor. FIN7 employed Carbanak as a private, fully featured command-and-control framework in campaigns that also targeted point-of-sale environments and payment-card data. The broader Carbanak campaign became one of the most consequential cyber-enabled bank theft operations publicly documented, affecting more than 100 financial institutions across over 40 countries and causing losses estimated in the hundreds of millions to roughly one billion dollars. The malware lineage later evolved into tooling tracked as Cobalt, and more recent activity indicates continued reuse of Carbanak tooling through modern loader chains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Carbanak (first tracked as Anunak) rewrote the economics of bank fraud... The heist worked in four unhurried phases: targeted spearphishing emails to bank employees carried weaponised Office documents that exploited known vulnerabilities and installed the Carbanak backdoor — a remote-access trojan built in part on leaked Carberp code, capable of keylogging, screenshots, screen-video recording and remote control.
Tools: SpicyOmelette, Cobalt Strike, Meterpreter, Mimikatz, CobtInt, ATMSpitter, Carbanak, Buhtrap, Cyst, Metasploit. CTU researchers assess with moderate confidence that GOLD KINGSWOOD is associated with, and may be a progression of the group referred to as Carbanak...
Carbanak has a plugin for VNC and Ammyy Admin Tool. Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.
The Carbanak lure warrants attention. Targeting security researchers and threat analysts with fake malware source code is a tactic previously associated with North Korean operations (Lazarus Group), though it is also used by sophisticated cybercrime groups.
Annotations ID Technique Tactic T1219 Remote Access Tools Command And Control BlackByte Carbanak Cobalt Group
27 distinct techniques documented for this family, organized by ATT&CK tactic.
FIN7 uses a range of custom and repurposed malware and tooling to support its operations. The group typically gains initial access through spearphishing emails containing malicious attachments or links hosted on compromised sites, often combined with callback phishing to increase credibility.
Many entries explicitly state malware 'can create a reverse shell' or 'launch a remote shell,' including 4H RAT, AuditCred, BLACKCOFFEE, Carbanak, DarkComet, Exaramel for Windows, PlugX, QuasarRAT, and ZxShell. | The content repeatedly describes use of cmd.exe, cmd /c, Windows command shell, and xp_cmdshell to execute commands, run payloads, launch binaries, perform reconnaissance, persistence, cleanup, and ransomware actions. Examples include: 'Sandworm Team used the xp_cmdshell command in MS-SQL', 'APT41 used cmd.exe /c to execute commands on remote machines', and many malware families 'can use cmd.exe to execute commands on a compromised host.'
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
A majority (95%) of samples of Carbanak obfuscate their internal data by hiding their network activity through code injection...
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
Environmental awareness allows malware samples to detect the underlying runtime environment of the system it is trying to infect... search for differences between a virtualized and bare metal environment... about one in five (17%) samples of the Carbanak malware samples analyzed by Lastline tried to detect a virtual sandbox before executing.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
Environmental awareness allows malware samples to detect the underlying runtime environment of the system it is trying to infect... search for differences between a virtualized and bare metal environment... about one in five (17%) samples of the Carbanak malware samples analyzed by Lastline tried to detect a virtual sandbox before executing.
The Carbanak backdoor logged keystrokes to harvest credentials and workflow detail.
"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"
Examples include: "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header," "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers," and "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."
BS2005 uses Base64 encoding for communication in the message body of an HTTP request... Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values... RDAT can communicate with the C2 via base32-encoded subdomains.
The backdoor communicated with its C2 over HTTP for tasking and exfiltration.
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A banking-focused backdoor/RAT used to infiltrate financial institutions, observe operator workflows, capture keystrokes and screen/video, move laterally, and enable ATM jackpotting, fraudulent transfers, and account-balance manipulation.
A historically significant financial intrusion toolkit/backdoor associated in the content with FIN7/Carbanak Group and major theft from financial institutions.
Referenced as a famous backdoor used as bait in the lure filename; the content explicitly states the sample is not actual Carbanak source code.
Referenced as a famous backdoor used as bait in the lure filename; the content explicitly states the sample is not actual Carbanak source code.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.